Skip to content

Updated

Qoder CLI

This guide uses LyraShield's integration registry for the cli surface. It shows the current setup strategy and client source; actual client loading and authenticated runtime acceptance are tracked separately below.

Connection setup

The registry's setup path for this client is Client configuration file over remote HTTP.

Client activation instructions

Install the remote MCP entry in `~/.qoder/settings.json` or project `.qoder/settings.json`, then complete authorization with Qoder CLI's documented `qoder mcp auth` flow and verify with `/mcp`. Project settings require approval and load only in trusted directories. LyraShield's Qoder CLI plugin package is still in preparation.

Manual fallback: merge the following into .qoder/settings.json. Complete OAuth in the client after adding the server. No API key belongs in this config.

{
  "mcpServers": {
    "lyrashield": {
      "url": "https://app.lyrashieldai.com/api/mcp",
      "type": "http"
    }
  }
}
Manual setup: the pinned CLI package (lyrashield@0.2.14) has no matching installer contract for this integration. Use the configuration or client instructions above and verify the client loads it.

Important gotchas

  • Qoder CLI uses `mcpServers` in `~/.qoder/settings.json` or project `.qoder/settings.json`; project entries require trust and may prompt for approval.
  • Remote HTTP OAuth is built into Qoder CLI. Use its `qoder mcp auth` command or `/mcp` flow; do not configure a static hosted API key for delegated actions.
  • Native CLI skills live in `.qoder/skills` and `~/.qoder/skills`. Qoder plugins can bundle MCP, commands, skills, hooks and workflows; the LyraShield plugin listing remains PREPARATION.
Hosted access: use OAuth when the client supports it. Hosted mutations require a browser-confirmed delegation and are checked against its workspace, scope and expiry. An API key alone does not authorize hosted mutations. See the Remote MCP guide.
Local access: run npx -y lyrashield@0.2.14 login --oauth to select a workspace for local stdio, or use a scoped workspace API key in an appropriate private environment. Never commit credentials.

Configuration locations

  • global: ~/.qoder/settings.json
  • project: .qoder/settings.json (shared by convention)

Native components and distribution

Documented client capabilities: plugin, skills, commands, hooks. These describe what the client can load; use the installer and distribution details below to see which LyraShield components are available for this surface.

Install shared LyraShield skills

The pinned CLI includes a skills installer for this client. Preview its file changes first, then run the install command. Existing files that are not LyraShield-owned, or have been customized, are preserved.

npx -y lyrashield@0.2.14 skills install qoder-cli --project --dry-run
npx -y lyrashield@0.2.14 skills install qoder-cli --project

Restart or reload the client and verify its skill list. Local files do not prove discovery, authentication, marketplace listing or runtime acceptance.

Distribution route: Qoder CLI plugin marketplace and native skills; registry state PREPARATION. Client distribution documentation.

Support evidence

Registry tier: COMPATIBLE. Evidence: DOCUMENTATION, checked 2026-10-01. Client version: not recorded; tested platforms: not recorded. No client runtime receipt is recorded.Marketplace state and runtime compatibility are separate claims.

Source: Qoder CLI official documentation.